
Europaisches Patenlamt 
European Patent Office 
Office europeen des brevets 




(12) 



(43) Date of publication: 

18.09.1996 Bulletin 1996/38 

(21) Application number: 96301696.9 

(22) Date ol filing: 13.03.1996 



0 i) EP 0 732 673 A2 

EUROPEAN PATENT APPLICATION 

(51) tnt ci ^: G07B 17/04 



(84) Designated Contracting States: 
CHDEFRGBLI 

(30) Priority: 17.03.1995 GB 9505433 

(71) Applicant: NEOPOST LIMITED 
Romford, Essex RM1 2AR (GB) 



(72) Inventor: Gilham, Dennis Thomas 
Brentwood, Essex CM13 2SL (GB) 

(74) Representative: 

Loughrey, Richard Vivian Patrick et al 
HUGHES CLARK & CO 
114-118 Southampton Row 
London WC1B5AA (GB) 



(54) Postage meter system and verification of postage charges 

(57) Methods of verifying use of postage charges in 

respect of mail items are disclosed. An authentication 

code is derived from a secret identification of a sender 

and a part of the destination address of the item. The 

code is printed on the mail item together with a sender 

account reference. On receipt of the mail item, the postal 

authority is able to use the account reference to access 

the secret identification and thereby determine if the 

destination address derived corresponds to that printed 

on the mail to verify the payment tor the postage charge. 
In a modification, each time a postage meter effects a 

transaction with a remote centre, the remote centre gen- 
erates and transmits to the meter a transaction number. 
The meter utilises a unique key to generate an encrypt- 
ed code based on an item count and the transaction 
number. The code and a meter identification are printed 
on the mail. The postal authority reads the meter iden- 
tification to access the unique key to decrypt the code 
and then compares the current transaction number with 
the transaction number derived from the code in order 
to verify the postage charges used by the sender. 
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Description 

This invention relates to postage meters for printing 
franking impressions on mail items in respect of postage 
charges levied on those items and to verification of au- 
thenticity of the franking impressions printed on the mail 
items. 

As is well known, postage meters carry out account- 
ing procedures in respect of postage charges for mail 
items whereby the meter determines the revenue to the 
postal authority in respect of the postage charges ap- 
plied to mail items by the user of the postage meter 
When used in an authorised manner the amount of the 
postage charge printed in the franking impression is 
properly accounted for. Postage meters are constructed 
in a secure manner to prevent or at least inhibit use of 
the postage meter in an unauthorised manner. In the 
event that security is breached and the meter used in 
an unauthorised manner evidence of such breach is pro- 
vided. The secure construction of the postage meter in- 
hibits unauthorised access to the accounting means and 
to the print head of the postage meter whereby attempts 
might be made to operate the postage meter in a fraud- 
ulent manner in which for example higher amounts of 
postage charge are printed than are accounted for by 
the accounting means. It will be appreciated that, if 
franking impressions are printed on mail items and the 
cost of the postage charges represented by the franking 
impressions have not been properly accounted for, rev- 
enue value is stolen from the postal authority. 

A further possibility of fraud on the postal authority 
is that a franking impression genuinely printed by a post- 
age meter is replicated on a plurality of mail items 
whereby only the cost of postage charge tor a single 
item is accounted tor in respect of a plurality of items. 

According to one aspect of the invention a method 
of verifying postage charges used by a mail sender 
against postage purchased by the mail sender is char- 
acterised by the steps of storing a current transaction 
identity number at a remote centre; each time a trans- 
action is effected between the remote centre and the 
postage meter generating a new transaction identity 
number and transmitting the new transaction identity 
number to the mail sender's postage meter, at the mail 
sender's postage meter generating a serial number for 
each mail item processed by the postage meter; using 
a unique key to generate an encrypted code from the 
serial number and the current transaction identity 
number; printing information on each mail item, the 
printed information including a franking impression, said 
encrypted code and an identification number relating to 
the postage meter; and at a postal authority mail han- 
dling depot the steps of reading the printed information 
and using the identification number to determine the 
unique key and the current transaction identity number; 
using the unique key to decrypt the encrypted code to 
yield the current transaction identity number and com- 
paring the current transaction identity number stored in 



the remote centre with the transaction identity number 
obtained from the encrypted code printed in the printed 
information. 

According to a second aspect of the invention ap- 
5 paratus for verifying postage charges used by a mail 
sender against postage purchased by the mail sender 
is characterised by memory means storing a current 
transaction identity number at a remote centre; means 
operative each time a transaction is effected between 
10 the remote centre and a postage meter located at the 
mail sender to generate a new transaction identity 
number and to transmit the new transaction identity 
number to the postage meter; said postage meter in- 
cluding a mail item counter to generate a serial number 
is for each mail item processed by the postage meter; cod- 
ing means operable to use a unique key to generate an 
encrypted code from the serial number and the current 
transaction identity number; and printing means for 
printing information on each mail item, the printed infor- 
20 mation including a franking impression, said encrypted 
code and an identification number relating to the post- 
age meter; and postal authority mail handling apparatus 
including reading means to read the printed information 
on each mail item; means responsive to the identifica- 
2S tion number to determine the unique key and the current 
transaction identity number; decoding means to use the 
unique key to decrypt the encrypted code to yield the 
current transaction identity number and comparison 
means to compare the current transaction identity 
30 number stored in the remote centre with the transaction 
identity number obtained from the encrypted code print- 
ed in the printed information. 

According to a third aspect of the invention a meth- 
od of verification of payment of postage charges in re- 
35 spect of a mail item is characterised by the steps at a 
mail sender of providing destination information on the 
mail item, deriving an authentication code from a mail 
sender's secret identification and at least an element of 
said destination information and printing said authenti- 
40 cation code and a sender account reference on the mail 
item and the steps at a postal authority of using the 
sender account reference to determine the mail send- 
er's secret identification to derive said destination infor- 
mation from the authentication code and comparing the 
45 derived destination information with the destination on 
the mail item to provide verification of the franking. 

According to a fourth aspect of the invention appa- 
ratus for verification of payment of postage charges in 
respect of a mail item is charcterised at a mail sender 
50 location by input means to input destination information 
in respect of the mail item; means providing a mail send- 
er's secret identification and a sender account refer- 
ence; code means to derive an authentication code from 
the mail sender's secret identification and at least an el- 
55 ement of said destination information; printing means 
operable to print said destination information, said au- 
thentication code and the sender account reference on 
the mail item and is characterised at a postal authority 
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by means operative in response to the sender account 
reference to determine the mail sender's secret identifi- 
cation to derive said destination information from the au- 
thentication code and comparing the derived destination 
information with the destination on the mail item to pro- 
vide verification of the franking. 

An embodiment of the invention will be described 
hereinafter by way of example with reference to the 
drawings in which:- 

Figure 1 illustratesd a mail item, 
Figure 2 is a block diagram of mail preparation ap- 
paratus at a mail senders location, 
Figure 3 is a block diagram of mail receiving appa- 
ratus at a postal authority location, 
Figure 4 is a flow chart of steps carried out by the 
apparatus of Figures 2 and 3 in preparing mail items 
and in verification of postage charges in a first meth- 
od, and 

Figure 5 is a flow chart of steps carried out by the 
apparatus of Figures 2 and 3 in an alternative meth- 
od. 

Reference will be made first to Figure 1 of the draw- 
ings. As is well known, mail items 10 such as envelopes 
carry destination information 11 and this information 
usually is located in a central area 12 of the envelope. 
The destination information may be printed on the outer 
surface of the envelope or, where window envelopes are 
used, the destination information is printed on an insert 
in the envelope. The destination information consists of 
a recipient 13 and postal address 14 to which it is re- 
quired that the mail item be delivered by the postal au- 
thority, the postal address including a post code 1 5. The 
destination information 11 is in plain text of human read- 
able characters but it is common for some mailers, es- 
pecially high volume mailers, to print the post code 15 
in bar code form. 

Referring now to Figure 2, mail preparation appa- 
ratus is similar to a postage meter and includes elec- 
tronic accounting and control means comprising a mi- 
cro-processor 18 operating under program routines 
stored in a read only memory (ROM) 19. A keyboard 20 
is provided for input of commands to control operation 
of the apparatus by a user. The keyboard also enables 
input of data such as postage charge and destination 
address information. A display 21 is provided to enable 
display of information to the user. A random access 
memory (RAM) 22 is provided for use as a working store 
for storage of temporary data during operation of the 
postage meter. Non-volatile memories 23, 24 are pro- 
vided for the storage of critical data relating to use of the 
postage meter and which is required to be retained even 
when the postage meter is not powered. The microproc- 
essor 18 carries out accounting functions in relation to 
use of the postage meter for franking mail items with 
postage charges applicable to handling of the mail items 
by the postal authority or another carrier. Accounting da- 



ta relating to use of the postage meter for printing frank- 
ing impressions representing postage charges for mail 
items and any other critical data to be retained is stored 
in the non-volatile memories 23, 24. The accounting da- 

s ta includes a value of credit available for use by the me- 
ter in franking mail items 10, an accumulated total of val- 
ue used by the meter in franking mail items, a count of 
the number of mail items franked by the meter and a 
count of the number of mail items franked with a postage 

10 charge in excess of a predetermined value. The value 
of credit is stored in a descending credit register, the 
accumulated total value is stored in an ascending tote 
register, the count of items is stored in an items register 
and the count of items franked with a postage charge in 

75 excess of a predetermined value is stored in a large 
items register. As is welt known in the postage meter art, 
each of the registers referred to hereinbefore for storing 
accounting data is replicated in order to enable integrity 
of the accounting data to be maintained even in the 

20 event of a fault or termination of power to the meter dur- 
ing a franking operation. Two replications of each of the 
registers are provided in each of the memory devices 
23, 24. 

A motor controller 25 is controlled by the microproc- 

2S essor 1 8 to control operation of motors 26 driving feed- 
ing means (not shown) for feeding a mail item past a 
digital print head 27. The digital print head 27 is prefer- 
ably a thermal print head including selectively energis- 
able thermal printing elements. Sensors 28 are provided 

30 to sense and monitor feeding of the mail item. The sen- 
sors provide signals to the microprocessor to enable the 
microprocessor to control feeding of the mail item and 
to selectively energise the thermal print elements of the 
print head 27 at appropriate times as the mail item is fed 

35 past the print head. As the mail item is fed past the ther- 
mal printing elements of the print head 27 during a print- 
ing operation, the microprocessor outputs on line 28, in 
each of a series of printing cycles, print data signals se- 
lecting those ones of the printing elements which are to 

40 be energised in each respective printing cycle. A pulse 
of electrical power is supplied to the selected thermal 
printing elements from a power source 29 when a strobe 
signal is supplied by the microprocessor on a line 30 to 
the print head. 

45 Repeated selection and energisation of selected 
printing elements in the series of printing cycles results 
in printing of dots in required positions of a correspond- 
ing series of columns spaced along the mail item in the 
direction of feeding of the item. Accordingly a complete 

so printed impression is built up in a column by column 
manner in the series of printing cycles of a printing op- 
eration. It is to be understood that although the mail 
preparation apparatus is described hereinbefore as in- 
cluding a thermal printer for printing on mail items, other 

55 types of digital printing device such as, for example, im- 
pact dot matrix, ink jet and laser may be provided: 

Postal authorities utilise automated equipment to 
handle a very high proportion ol the mail items received 
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in the postal system. Such equipment, as shown in Fig- 
ure 3, is provided with electronic means 31 for reading 
the destination information. The reading means 31 is re- 
quired to operate reliably at high feed speeds of the mail 
items and consequently is expensive. Accordingly, 
since the reading means is required to capture data only 
from the destination information 11. the reading means 
has a range of vision extending from adjacent a lower 
edge of the envelope to an extent sufficient to span the 
area 12 in which the destination information is located. 
As a result the reading means does not necessarily scan 
the upper area of the envelope in which any franking 
impression 16 is printed. 

Revenue protection can be improved if the activity 
of a sender of mail is checked against postage value 
purchased by the sender. Any substantial discrepancy 
between the monitored activity and the postage value 
purchased indicates the likelihood of fraud and can then 
be investigated. 

The address information 14 is required to be proc- 
essed on all mail items and hence it is proposed to em- 
bed information 1 7 identifying the sender of the mail item 
in the destination information 11 and to capture this iden- 
tification information at the same time that the destina- 
tion address 1 1 is read. The sender identification 1 7 may 
be merely the post code of the sender but this would be 
too easy for anyone to copy for fraudulent purposes. 
Therefore it is preferred that the sender identification 1 7 
be protected so as to provide security both for the send- 
er and for the postal authority. 

The sender identification printed on the mail item 
includes two elements. The first element is a sender ac- 
count reference 32 by which the postal authority can 
identify the sender and the second element is an au- 
thentication code 33. Referring to Figure 3, after input 
of the destination information (step 34) the microproc- 
essor 18 genrates (step 35) the authentication code us- 
ing an algorithm which operates on a selected part of 
the destination information to be printed on the mail 
item, for example the destination post code 1 5. An iden- 
tity number, stored in the memories 23, 24 and known 
only to the sender and the postal authority is used in 
generation of the authentication code to ensure that the 
authentication code is unique to the sender. Software 
controlling operation of the apparatus includes routines 
stored in ROM 19 to generate the authentication code. 
The microprocessor 18, operating under the control of 
software routines operates the printer 27 to print (step 
36) a franking impression and the destination informa- 
tion, the latter including the sender identification. 

The authentication code may be printed in charac- 
ter form, i.e alpha-numeric, or in bar-code or other sym- 
bolic code form. If the authentication code is printed in 
bar-code form it may be combined with a destination 
post code printed in bar-code form as a two stack bar- 
code, or alternatively as an extended bar code. 

When a mail item is received at a postal authority 
sorting office, the mail reader 31 of an automated mail 



handling system 37 at the postal authority reads (step 
38) the authentication code and uses (step 39) the ac- 
count reference read from the mail item to determine, 
from a database 40, the identity number of the sender. 
5 Tne identity number is then used (step 41) to decode 
the authentication code to yield a destination post code 
tor the item. The destination post code yielded by step 
41 is checked (step 42) with the destination code 15 
read from the destination address printed on the item to 
10 provide a verification of authenticity of the item. If the 
check (step 42) indicates correspondence between the 
post codes (YES output of step 42). the mail handling 
process is continued and the senders activity record in 
the database 39 is updated (step 43). However if the 
is check indicates a lack of verification (NO output of step 
42), the mail item is diverted (step 44) for manual in- 
spection. The activity record of the sender may be mere- 
ly a record of the number of mail items processed in a 
period of time or an audit trail containing number of 
20 items, dates and destinations of the items. 

Using the number of mail items received by the 
postal authority from a sender and an average postage 
charge value, the postal authority is enabled to estimate 
an approximate total postage charge value of items re- 
2S ceived from that sender and to correlate the estimated 
total postage charge value with the amount of postage 
purchased by that sender. Postage meters also account 
tor the number of mail items printed with a Iranking im- 
pression and this information may be utilised to provide 
30 further correlation between mail items processed by the 
postage meter and mail items received by the postal au- 
thority. It will be appreciated that checking the activity of 
the sender as described hereinbefore and correlating 
this information against purchase of postage can im- 
3S prove the security of revenuetothe postal authority with- 
out costly change, either in cost or performance, to the 
automated mail handling equipment of the postal au- 
thority. 

Duplication of an authentic franking impression is 
40 relatively easy using commonly available equipment. 
Franking impressions which are not authentic and are 
merely a copy of an authentic impression may be de- 
tected if an element of the destination information is in- 
cluded in the franking impression. However this does 
45 not fit well with the normal manner in which mail is han- 
dled by a sender. Usually, the mail item is prepared by 
printing the destination information at one location of the 
sender's premises and the franking impression is print- 
ed subsequently at a different location of the sender's 
so premises. Another approach is for the postal authority 
to read all franking impressions and to capture the post- 
age charges thereof to generate a record of total post- 
age charge used. This record can then be used as a 
check against postage purchased by the sender. Fur- 
55 thermore this may not be able to detect all attempts at 
fraud as readily as is required. 

An improvement in detection of attempts at fraud 
may be obtained by shortening the time period over 
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which a comparison of the information is carried out. Ac- 
cordingly information is included in thetranking impres- 
sion which is a function of a meter control transaction. 
A control transaction may be either resetting the meter 
with a new postage credit amount and reading meter 
registers or just reading the meter registers. The regis- 
ters information may include the number of mail items 
processed by the meter. 

The mail preparation apparatus, shown in Figu re 2, 
is provided with an I/O port 45 to enable communication 
via a communication link 46, for example a telephone 
network, with a remote resetting centre 47 whereby 
transactions with the remote centre may be effected. 
Referring now to Figure 5. each time when a remote 
transaction is initiated (step 48), a transaction identity 
number is generated (step 49) by the remote centre 47 
and is stored in a store 50 at the remove centre. The 
transaction identity number is transmitted from the re- 
mote resetting centre 47 to the postage meter and this 
transaction identity number is stored in the non-volatile 
memories 23, 24. The postage meter generates (step 
51 ) a sequential item number for each mail item and this 
is combined (step 52) with the transaction identity 
number to form an encrypted code. The encryption may 
be effected using a unique key and a non-linear algo- 
rithm. The postage meter prints (step 53) information on 
the mail item, the printed information includes the frank- 
ing impression 16 including a postage charge value for 
the mail and the information also includes the meter li- 
cense number, sequential number of that item and the 
encrypted code. The printed information is read (step 
54) by the mail reader 31 and captured by the postal 
authority automated mail handling system 37 during 
normal processing of the mail items. The license 
number is used to determine (step 55) from the data- 
base 40 the unique key and the current transaction iden- 
tity number. The unique key is used to decrypt (step 56) 
the code and thereby yield the transaction number em- 
bedded in the code. The transaction identity number ob- 
tained from the code is checked (step 57) against the 
transaction number from the database 40. It the check 
is satisfactory (YET output of step 57) the sequential 
item number and the postage charge for the item are 
then entered (step 58) into the senders account record. 
Otherwise if the check is not satisfactory (NO output of 
step 57), the mail item is diverted (step 59) for manual 
inspection. It is preferred that the meter license number, 
sequential number of the item and the encrypted code 
are included as a part of the Iranking impression but if 
desired these information items may be printed on a dif- 
ferent part of the mail item and for example may be print- 
ed in an area 12 of the mail item in which a destination 
is printed. 

It will be appreciated that where information printed 
as a part of the franking impression is required for use 
in monitoring the activity of the sender, it is necessary 
that means be provided for automatically reading the ar- 
ea of the envelope in which the franking impression is 



printed. 

It will be appreciated that operations and steps car- 
ried out in the postage meter are performed by the mi- 
croprocessor 18 under the control of program routines 

5 stores in ROM. Furthermore, as is well known in the 
postage meter art, the postage meter must operate in a 
secure manner and be protected from attempts to use 
the meter fraudulently for example by utilising the post- 
age meter to print franking impressions on mail items 

10 for which no corresponding postage charge has been 
accounted for by the accounting means. Accordingly 
those parts of the postage meter required to be secured 
against unauthorised tampering are housed in a secure 
housing 60. 
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Claims 

1. A method of verifying postage charges used by a 
20 mail sender against postage purchased by the mail 
sender characteriseed by the steps of storing a cur- 
rent transaction identity number at a remote centre; 
each time a transaction is effected between the re- 
mote centre and the postage meter generating a 
25 new transaction identity number and transmitting 
the new transaction identity number to the mail 
sender's postage meter; at the mail sender's post- 
age meter generating a serial number for each mail 
item processed by the postage meter; using a 
30 unique key to generate an encrypted code from the 
serial number and the current transaction identity 
number; printing information on each mail item, the 
printed information including a franking impression, 
said encrypted code and an identification number 
35 relating to the postage meter; and at a postal au- 
thority mail handling depot the steps of reading the 
printed information and using the identification 
number to determine the unique key and the current 
transaction identity number* using the unique key 
40 to decrypt the encrypted code to yield the current 
transaction identity number and comparing the cur- 
rent transaction identity number stored in the re- 
mote centre with the transaction identity number ob- 
tained from the encrypted code printed in the print- 
45 ed information. 

2. A method as claimed in claim 1 wherein the encrypt- 
ed code and the identification number are printed 
as a part of the Iranking impression. 

so 

3. Apparatus for verifying postage charges used by a 
mail sender against postage purchased by the mail 
sender characterised by memory means (50) stor- 
ing a current transaction identity number at a re- 

55 mote centre; means (47) operative each time a 
transaction is eflected between the remote centre 
(47) and a postage meter located at the mail sender 
to generate a new transaction identity number and 
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to transmit the new transaction identity number to 
the postage meter; said postage meter including a 
mail item counter to generate a serial number for 
each mail item processed by the postage meter; 
coding means operable to use a unique key to gen- 5 
erate an encrypted code from the serial number and 
the current transaction identity number; and printing 
means (27) tor printing information on each mail 
item (10) , the printed information including a frank- 
ing impression (16), said encrypted code (33) and io 
an identification number relating to the postage me- 
ter (32); and postal authority mail handling appara- 
tus including reading means (31 ) to read the printed 
information on each mail item (10); means (37) re- 
sponsive to the identification number to determine « 
the unique key and the current transaction identity 
number; decoding means to use the unique key to 
decrypt the encrypted code to yield the current 
transaction identity number and comparison means 
to compare the current transaction identity number 20 
stored in the remote centre with the transaction 
identity number obtained from the encrypted code 
printed in the printed information. 

4. A method ol verification of payment of postage 2s 
charges in respect of a mail item characterised by 
the steps at a mail sender of providing destination 
information on the mail item, deriving an authenti- 
cation code from a mail sender's secret identifica- 
tion and at least an element of said destination in- *o 
format ion and printing said authentication code and 

a sender account reference on the mail item and 
the steps at a postal authority of using the sender 
account reference to determine the mail sender's 
secret identification to derive said destination infor- -35 
mation from the authentication code and comparing 
the derived destination information with the desti- 
nation on the mail item to provide verification of the 
franking. 

40 

5. A method as claimed in claim 4 wherein the authen- 
tication code and sender account reference are 
printed in an area of the mail item in which the des- 
tination information is printed. 

46 

6. Apparatus for verification of payment of postage 
charges in respect of a mail item characterised at a 
mail sender location by input means (20) to input 
destination information (11) in respect of the mail 
item (10); means providing a mail sender's secret so 
identification and a sender account reference (23, 
24); code means (18) to derive an authentication 
code from the mail sender's secret identification and 

at least an element of said destination information 
(11); printing means (27) operable to print said des- 55 
tination information (11), said authentication code 
(13) and the sender account reference (32) on the 
mail item (10) and characterised at a postal author- 



ity by means (37) operative in response to the send- 
er account reference to determine the mail sender's 
secret identification to derive said destination inform 
mation from the authentication code and comparing 
the derived destination information with the desti- 
nation on the mail item to provide verification of the 
franking. 
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I 



5A 



USB LICENSE NUMBER TO ACCESS 
UNIQUE KEY AND TRANSACTION IDENTITY 



I 



-55 



USE KEY TO DECRYPT CODE AND 
YIELD TRANSACTION IDENTITY 



-56 



DERIVED 
"TRANSACTION IDENTITY 
CORRESPONDS TO STORED 
^TRANSACTION IDENTITY ^ 

9 



NO 



57' 



YES 



58- 



ENTER SEQUENTIAL NUMBER 
AND POSTAGE INFORMATION. 
INTO USER ACCOUNT RECORD 





59 

> 




DIVBRT FOR 




MANUAL 




INSPECTION 



FI6.5 
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